How to prevent fake account creation
Stop the bots at the signup form, and make sure the fake accounts that still get through are worth nothing. In practice that means a bot check your server verifies, email confirmation before an account goes live, limits on signups per network, and no trial, credit or bonus until those checks have passed. None of these steps is enough on its own, but together they make bulk signups slow and unprofitable.
- Put a bot check on the signup form and verify its result on the server, in the code that creates the account. An invisible CAPTCHA does this without a puzzle, so real users have nothing extra to do.
- Confirm the email address before the account becomes active. A made-up address never confirms, and the account stays an empty shell.
- Limit signups per IP address, network and device. One person rarely needs ten accounts in an hour. A script does.
- Flag disposable email domains. Lists of throwaway domains catch the cheap attacks, but they go out of date and catch some real users too, so treat a match as one risk signal among others rather than an automatic block.
- Let the bot score decide the doubtful cases. Accept clear humans, block clear bots, and ask the middle group for one extra step, such as an SMS code.
- Hold back what fake accounts come for. Unlock free trials, credits, referral bonuses and welcome discounts only after verification, and allow one per confirmed email address, phone number or payment method.
- Review new accounts for patterns. Bursts of signups from one network, numbered email addresses and accounts that never log in again stand out in a weekly report. Freeze them before they are used.
If your signup gives anything away for free, someone will try to collect it more than once. The list runs in the order a signup passes through, and the earlier a fake one is stopped, the less it costs you.
What is fake account creation?
Fake account creation is the registration of user accounts with made-up, stolen or synthetic details by someone who has no intention of using the service like a customer. Usually scripts do it, in bulk. Some of it is done by hand, by people paid per account.
The accounts are rarely the goal in themselves. They are used to claim a free trial again and again, collect welcome discounts and referral bonuses, send spam to real users, post fake reviews or inflate follower counts. Others sit quietly until they are old enough to look trustworthy, and are then sold or used for fraud.
How bots create fake accounts
1. Throwaway identities
Attackers start with the details your form asks for. Disposable email services and virtual phone numbers give them as many inboxes and SMS numbers as they need, and data from breaches or generated “synthetic” identities fill in names and addresses.
2. A new IP address each time
Proxy networks and VPNs give every attempt a different IP address, often from home connections that look like ordinary customers. Anti-detect browsers change the device fingerprint as well, so a batch of signups looks like visitors from all over the world.
3. The script signs up
A script or headless browser fills in the form. Often it skips the form entirely and sends the request straight to the signup API the form calls, which is why a check that only runs in the browser is easy to get around. Where a form shows an image puzzle, solving services return the answer for a small fee; our article on how bots bypass CAPTCHAs covers those tricks.
4. The accounts get used
Some accounts are used at once to collect a bonus or send spam. Others are left alone for weeks, then sold or used for fraud. The same bot networks often try leaked passwords on your login form too, known as credential stuffing. Our pages on brute force protection and account takeover protection cover that side.
Fake signup protection for registration forms
The registration form is the cheapest place to stop a fake account: before it exists, before any email or SMS goes out, before a trial starts. Good fake signup protection at that point does three things.
It checks on the server. The widget in the browser produces a token, and the code that creates the account sends that token to the CAPTCHA provider and refuses the signup if it is missing or invalid. Every other endpoint that creates accounts, such as the one a mobile app calls, needs the same rule.
It stays out of the way. Each extra field or puzzle costs you real signups. A check that starts on its own while the visitor types keeps the form exactly as short as it was.
It decides by risk. A score lets you treat a clear human, a clear bot and the doubtful middle differently: accept, block, or ask for an email or SMS code before the account is activated.
So, can a CAPTCHA stop fake signups? It stops the automated ones, and those are the ones that arrive in volume. It does not stop a person typing in details by hand. That is what email confirmation and limits on rewards are for. The same check also works on your contact and newsletter forms; see form spam protection.
What is the best way to stop fake accounts on retail platforms?
On a retail platform, fake accounts chase things with a cash value: welcome discounts, first-order coupons, loyalty points, referral credit, and limited products with a per-customer limit. The best approach combines a bot check on registration and login with offers that unlock only for a confirmed customer. Give one welcome code per confirmed email address and payment method, pay referral credit after the referred customer’s first paid order, and set purchase limits per verified customer and delivery address rather than per account.
That last point matters most for limited drops. If the limit counts accounts, a reseller simply opens more accounts. Our page on ecommerce fraud prevention goes into checkout and payment fraud.
Account creation fraud: what it costs
Account creation fraud is fake account creation for money: accounts opened to collect bonuses, reuse trials or prepare payment fraud. We have not found an industry figure for its cost that we would trust, and your own number depends on what your signup gives away. The costs show up in the same places on most sites:
- Each signup that sends a confirmation email or an SMS code costs money. Bots can also request SMS codes to number ranges that pay the attacker per message, a scheme known as SMS pumping.
- Free trials, credits, welcome discounts and referral bonuses get claimed again and again.
- CRM, email and analytics tools often bill per contact or tracked user, and fake accounts count too.
- Emails to made-up addresses bounce, and a high bounce rate hurts the delivery of the emails your real customers wait for.
- Signup numbers, conversion rates and A/B tests include the fakes, so decisions rest on wrong figures.
- Support, moderation and the cleanup after someone notices all take staff time.
To put a figure on it, take the fake signups you found last month and add up what one cost you in messages, giveaways and staff time. That is the budget a bot check has to beat.
How TrustCaptcha prevents fake account creation
TrustCaptcha sits on the signup form as a small widget that starts on its own when the page loads. In the background, the visitor’s browser solves a proof-of-work task, and the widget sends technical and behavioral signals for a bot score. The task gets harder as the risk rises, so a script that registers account after account pays for each one in computing time, while a real visitor fills in the form and notices nothing.
When the form is submitted, your server fetches the result with one API call and decides what happens: create the account, block it, or ask for an extra step when the score is doubtful. From the Solo plan you get bot detection with risk scoring, IP allow and block lists, and rules that raise the difficulty for traffic from specific countries, devices or IP ranges. The Team plan adds geoblocking and your own access rules.
TrustCaptcha sets no cookies, processes data in EU data centers and comes with a Data Processing Agreement for every customer. The widget is visible on the form but needs no click; a fully invisible widget is available as a paid add-on.
Try TrustCaptcha
Every plan starts with a 14-day free trial, and non-commercial websites can use TrustCaptcha for free. Start your free trial, put it on your signup form, and compare the bot scores of new signups with the accounts you had to delete last month.
